Scorecard supply-chain security #64

	name: Scorecard supply-chain security
	on:
	branch_protection_rule:
	schedule:
	- cron: '25 10 * * 5'
	workflow_dispatch:
	push:
	branches: ["master"]

	permissions: read-all

	jobs:
	analysis:
	name: Scorecard analysis
	runs-on: ubuntu-latest
	permissions:
	# Needed to upload the results to code-scanning dashboard.
	security-events: write
	# Needed to publish results and get a badge (see publish_results below).
	id-token: write

	steps:
	- name: Harden runner
	uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # ratchet:step-security/harden-runner@v2
	with:
	disable-sudo: true
	egress-policy: block
	allowed-endpoints: >
	api.osv.dev:443
	api.securityscorecards.dev:443
	bestpractices.coreinfrastructure.org:443
	fulcio.sigstore.dev:443
	github.com:443
	api.github.com:443
	rekor.sigstore.dev:443
	sigstore-tuf-root.storage.googleapis.com:443
	www.bestpractices.dev:443

	- name: "Checkout code"
	uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # ratchet:actions/checkout@v4
	with:
	persist-credentials: false

	- name: "Run analysis"
	uses: ossf/[email protected]
	with:
	results_file: results.sarif
	results_format: sarif
	publish_results: false

	- name: "Upload artifact"
	uses: actions/upload-artifact@3cea5372237819ed00197afe530f5a7ea3e805c8 # ratchet:actions/upload-artifact@v3
	with:
	name: SARIF file
	path: results.sarif
	retention-days: 5

	- name: "Upload to code-scanning"
	uses: github/codeql-action/upload-sarif@1b1aada464948af03b950897e5eb522f92603cc2 # ratchet:github/codeql-action/upload-sarif@v3
	with:
	sarif_file: results.sarif

Provide feedback